CVE-2026-62382: PasswordPusher allows unauthenticated deletion of anonymous pushes due to a nil==nil ownership check that bypasses viewer-deletion restrictions.

flaw (CWE-863) in the push-deletion paths. Both the JSON API (Api::V1::PushesController#destroy) and the HTML UI (PushesController#expire) authorize deletion with (@push.user == current_user) || @push.deletable_by_viewer. For an anonymous push @push.user is nil, and for an unauthenticated request current_user is also nil, so the ownership comparison evaluates nil == nil → true. The deletable_by_viewer restriction is therefore bypassed, and anyone who knows only the secret URL can permanently delete (expire!) an anonymous push — clearing payload, passphrase, and attached files — even when viewer deletion was explicitly disabled and a passphrase protects reads.

pglombardo/pwpush Docker images.

• Affected versions: v1.45.11 – v2.9.5 (fixed in v2.9.6). Only deployments allowing anonymous pushes (the default) are affected.
• Risk: Medium (CVSS 4.0: 6.9). Unauthenticated denial-of-service against secrets in transit: an attacker who learns or guesses a secret URL token can irreversibly destroy the push before the intended recipient retrieves it.

Impact Parity

• Disclosed/claimed maximum impact: authorization bypass — unauthenticated deletion of anonymous pushes (authz_bypass).
• Reproduced impact from this run: identical. An unauthenticated DELETE /p/<url_token>.json against pwpush 2.9.5 returned HTTP 200, set expired=true/deleted=true, cleared the passphrase, and destroyed the payload (subsequent authorized read with the correct passphrase returned "payload": null). The HTML route DELETE /p/<url_token>/expire also destroyed the push (HTTP 302 + push expired).
• Parity: full.
• Not demonstrated: nothing claimed beyond the authorization bypass / data destruction (no code execution was claimed or attempted).

Root Cause

In v2.9.5 the deletion guards were:

• app/controllers/api/v1/pushes_controller.rb (destroy): if (@push.user == current_user) || @push.deletable_by_viewer
• app/controllers/pushes_controller.rb (expire): unless @push.deletable_by_viewer || (@push.user == current_user)

Push#user is a nullable belongs_to. Anonymous pushes have user_id = NULL, so @push.user is nil. Devise's current_user is nil when the request is unauthenticated. Ruby evaluates nil == nil as true, so the "owner" branch succeeds and the deletable_by_viewer check is never reached. expire! then clears payload, passphrase, and files and marks the push expired/deleted — irreversible.

Fix (v2.9.6, diff v2.9.5...v2.9.6): both controllers now call a new model method Push#deletable_by?(user):

def deletable_by?(user)
  (user.present? && user_id == user.id) || deletable_by_viewer == true
end

which requires an authenticated (present?) user whose id matches the owner, removing the nil==nil equivalence. Advisory: https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-jf2m-hpj9-4qx2

Reproduction Steps

1. bundle/repro/reproduction_steps.sh (self-contained; requires Docker).
2. The script:
   • Pulls and starts the real product images pglombardo/pwpush:2.9.5 (vulnerable, port 15100) and pglombardo/pwpush:2.9.6 (fixed, port 15101).
   • Waits for HTTP readiness, then completes the real first-run setup flow (extracts the one-time boot code from container logs and creates the admin account), mirroring a fresh deployment.
   • As an unauthenticated client, creates an anonymous push with payload=SUPER-SECRET-CVE-2026-62382, passphrase=s3cr3t, deletable_by_viewer=false.
   • Verifies the payload is unreadable without the passphrase (HTTP 401).
   • Sends DELETE /p/<url_token>.json with no session and no passphrase.
   • Re-reads the push with the correct passphrase and evaluates state.
   • Repeats the identical flow against the fixed image as a negative control, and additionally exercises the HTML DELETE /p/<token>/expire route on the vulnerable instance as secondary evidence.
3. Expected evidence: vulnerable → DELETE HTTP 200, push expired=true, deleted=true, payload=null; fixed → DELETE HTTP 401 ("That push is not deletable by viewers."), payload intact.

Evidence

• bundle/logs/reproduction_steps.log — full run transcript. Key excerpts:

  [repro] [vuln] read without passphrase -> HTTP 401
  [repro] [vuln] unauthenticated DELETE /p/cxlwytxdhjwx.json -> HTTP 200
  [repro] [fixed] unauthenticated DELETE /p/5hpxxmf2x6_unhxtmq.json -> HTTP 401
  [repro] vuln:  DELETE=200 expired=true deleted=true payload=null
  [repro] fixed: DELETE=401 expired=false payload=SUPER-SECRET-CVE-2026-62382
  [repro] RESULT: CVE-2026-62382 CONFIRMED (vuln exploited, fixed rejected).
  

• bundle/artifacts/http/vuln_delete_response.json — vulnerable DELETE response body: expired:true, deleted:true, passphrase:null.

• bundle/artifacts/http/vuln_read_after_delete.json — authorized read after the attack returns "payload": null (secret destroyed).

• bundle/artifacts/http/vuln_read_without_passphrase.json — pre-attack 401 proves the passphrase gate was active.

• bundle/artifacts/http/vuln_html_expire_response.txt — HTML route also expires the push unauthenticated.

• bundle/artifacts/http/fixed_delete_response.json — 401 + {"error":"That push is not deletable by viewers."}.

• bundle/artifacts/http/fixed_read_after_delete.json — payload intact on fixed version.

• bundle/logs/pwpush_vuln_service.log / bundle/logs/pwpush_fixed_service.log — container logs (Puma boot, first-run, request handling).

• bundle/repro/runtime_manifest.json — runtime manifest with image digests and SHA-256 of every proof artifact.

• Environment: Docker 29.1.3 on Linux x86_64; images pglombardo/pwpush:2.9.5 (sha256:ba5cf45b…) and pglombardo/pwpush:2.9.6 (sha256:c9662425…), Ruby 4.0.6 / Rails 8.1.3.1, production environment with default settings (allow_anonymous enabled).

Recommendations / Next Steps

• Upgrade to PasswordPusher ≥ v2.9.6 (or apply the Push#deletable_by? patch).
• Never use record.user == current_user as an ownership test when either side can be nil; require current_user.present? && record.user_id == current_user.id.
• Add regression tests: unauthenticated DELETE/expire of an anonymous push with deletable_by_viewer=false must be rejected (the fix release adds test/integration/password/password_json_deletion_test.rb etc.).
• Defense-in-depth: deployments that do not need anonymous pushes should set allow_anonymous: false; secret URL tokens should be treated as bearer secrets and rotated.

Additional Notes

• Idempotency: the script removes/recreates its containers (pwpush-vuln-repro, pwpush-fixed-repro) on each run, performs first-run setup from scratch, and exits 0 only when the vulnerable instance is exploited AND the fixed instance rejects the attack. Verified passing twice consecutively in this run.
• First-run admin setup is required by current PasswordPusher images before any push can be created; the script automates it via the boot code printed to container logs. This reflects real deployment behavior and does not affect the unauthenticated attack surface.
• Limitations: the boot-code extraction depends on the Docker log driver; a non-Docker deployment would need the equivalent first-run step. The claimed entrypoint (DELETE /p/<url_token>.json) is exercised directly; the HTML /expire route is included only as secondary evidence.